Hackers Can Inject Malicious Code into Antivirus Processes to Create a Backdoor
\n \t
\n
<\/BR>
\n
\n \t
\n
<\/BR><\/p>\n
A new technique enables attackers to exploit antivirus software by injecting harmful code directly into the antivirus processes. This approach makes it easier for them to evade detection and compromise the security that antivirus software is designed to provide.<\/p>\n
This method, detailed by cybersecurity researcher Two Seven One Three on X (@TwoSevenOneT), involves cloning protected services and hijacking cryptographic providers to create a backdoor in the antivirus installation folder, bypassing standard defenses.<\/p>\n
The approach highlights a vulnerability in how antivirus solutions prioritize their own stability. By injecting code into these \u201cunkillable\u201d processes, researchers gain elevated privileges to perform actions like writing files to restricted directories, all while evading detection. <\/p>\n
As antivirus programs evolve to combat sophisticated threats, such techniques underscore the delicate balance between robust security and operational reliability.<\/p>\n
Antivirus software employs multiple strategies to shield its core processes from interference, ensuring uninterrupted protection for users.<\/p>\n
These programs typically run with SYSTEM-level privileges, granting them broad access to monitor and neutralize threats across the system.<\/p>\n
Process introspection allows the antivirus to vigilantly scan its own threads for anomalies, such as unauthorized code injections from external sources.<\/p>\n
Further safeguards include code integrity checks that verify the authenticity of loaded modules and the use of Windows\u2019 Protected Process Light (PPL) feature.<\/p>\n